Comparison — Postfleet vs LobsterMail
LobsterMail and Postfleet both screen inbound email for prompt injection before an agent reads it; the difference is what happens when the screen fires. LobsterMail scores each message, strips detected patterns, and leaves the skip-or-process decision to your code. Postfleet fails closed: on injection risk it skips extraction, and its MCP read tool never returns the raw body.
When the policy on a flagged message should be enforced by the service, not by a branch in your handler: sanitization with an audit report, spam and virus gates, sender-auth verdicts, confidence-scored extraction, approval before send, and a dead-letter queue for when your webhook is down.
When you want an agent to mint its own inbox in one call, block until a verification email arrives, and read PDF attachments inside the same extraction request, and you are comfortable writing the skip-or-process policy around the injection score yourself.
Pricing model. LobsterMail lists a free plan with 1,000 emails a month and no card, Builder at $9 a month, and Scale at $99 a month with dedicated IPs, as of September 6, 2026; sending on any plan first requires a one-time account verification by public tweet. Postfleet is priced per comprehended message, at $0 for 100 a month, $20 for 1,500, and $200 for 25,000 or more, with unmetered sanitization on every plan.
“DIY” means the capability can be assembled on the platform but is not enforced as a built-in service. “Not documented” means the public product documentation reviewed does not substantiate the capability; it does not mean the capability is impossible.
Swipe or scroll to compare →
| Capability | Postfleet | LobsterMail |
|---|---|---|
| Comprehension & security | ||
| Prompt-injection screening with fail-closed handling | Yes | DIY |
| Content sanitization with an audit report | Yes | DIY |
| JSON Schema extraction | Yes | Yes |
| Confidence scores on extracted fields | Yes | Not documented |
| Automatic message classification | Yes | Not documented |
| Blocking wait for a matching email | Yes | Yes |
| PDF text included in message processing | No | Yes |
| Inbound SPF / DKIM / DMARC verdicts surfaced | Yes | Yes |
| Layered spam gate with quarantine and recovery | Yes | Not documented |
| Virus gate with fail-closed delivery | Yes | Not documented |
| Async attachment byte scanning before download | No | Not documented |
| Sending controls & delivery reliability | ||
| Server-enforced human approval before send | Yes | No |
| Automatic webhook retries | Yes | Yes |
| Dead-letter queue with self-serve redrive | Yes | No |
| Inbox essentials | ||
| MCP server (hosted + local) | Yes | Yes |
| REST API | Yes | Yes |
| Webhooks | Yes | Yes |
| Send + receive | Yes | Yes |
| Custom domains (DKIM / SPF / DMARC) | Yes | Yes |
| Threading | Yes | Yes |
| Mailbox-scoped API keys with read / send flags | Yes | Not documented |
| Send allowlists / blocklists | Yes | Not documented |
| Idempotent message sends | Yes | Not documented |
| Where LobsterMail is broader today | ||
| Client SDK for the REST API (TypeScript, on npm) | No | Yes |
| n8n community node | No | Yes |
| Dedicated IP addresses on the Scale plan | No | Yes |
| Search across every inbox by keyword, sender, and date | No | Yes |
It scores. Every message carries an injectionRiskScore from 0 to 1, an isInjectionRisk flag at 0.5 and above, and a safeBodyForLLM method that strips detected patterns and wraps the body in boundary markers. The raw body stays in the response, and the docs ask you to decide whether to skip, flag, or process. Postfleet skips extraction on injection risk and returns only the screened message over MCP.
It wraps the body in EMAIL_CONTENT_START and EMAIL_CONTENT_END markers with a header telling the model the content is untrusted, and strips injected boundary markers and detected injection patterns. It is a convenience method rather than a delivery gate: the raw body field remains in the response, and the docs warn never to pass it to a model directly.
The documentation covers a local server started with npx that shares a token file with the SDK, with setup for Claude Code, Claude Desktop, and Cursor. No hosted endpoint is documented. Postfleet ships both: a hosted server, and a local one published on npm as @postfleet/mcp.
Each delivery is retried up to five times with exponential backoff. After ten consecutive failures the webhook is disabled, and re-enabling it means deleting and recreating it; no dead-letter queue or replay is documented. Postfleet retries, then parks failures in a dead-letter queue you can redrive from the dashboard.
Yes. You pass a JSON schema to extractStructured, and text from PDF attachments is parsed and included in the same extraction context automatically. Per-field confidence scores are not documented. Postfleet returns a confidence score with each extraction but does not include PDF text in message processing today.
The same table and the same legend, against the other ways teams give an agent an inbox.
Last verified September 6, 2026. We compared documented product behavior, not what could be built with additional infrastructure. LobsterMail links point to its primary documentation; Postfleet links point to the product pages that describe the corresponding controls.